/******************************************************************/
/*                                                                */
/*  Winpooch : Windows Watchdog                                   */
/*  Copyright (C) 2004-2007  Benoit Blanchon                      */
/*                                                                */
/*  This program is free software; you can redistribute it        */
/*  and/or modify it under the terms of the GNU General Public    */
/*  License as published by the Free Software Foundation; either  */
/*  version 2 of the License, or (at your option) any later       */
/*  version.                                                      */
/*                                                                */
/*  This program is distributed in the hope that it will be       */
/*  useful, but WITHOUT ANY WARRANTY; without even the implied    */
/*  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR       */
/*  PURPOSE.  See the GNU General Public License for more         */
/*  details.                                                      */
/*                                                                */
/*  You should have received a copy of the GNU General Public     */
/*  License along with this program; if not, write to the Free    */
/*  Software Foundation, Inc.,                                    */
/*  675 Mass Ave, Cambridge, MA 02139, USA.                       */
/*                                                                */
/******************************************************************/

#ifndef _UNDOCUMENTED_H
#define _UNDOCUMENTED_H

#include <ddk/ntddk.h>
#include <ddk/winddk.h>
#include <ddk/ntapi.h>
#include "types.h"

/******************************************************************/
/* Macros                                                         */
/******************************************************************/

#ifndef PACKED
#define PACKED __attribute__((__packed__))
#endif

#ifndef NTUNDOC
#define NTUNDOC extern
#endif


/******************************************************************/
/* Constants                                                      */
/******************************************************************/

#define FileNameInformation	9
#define FileRenameInformation	10
#define FileLinkInformation	11

#define KeyNameInformation 3

#define OBJ_KERNEL_HANDLE	0x0200

#define OB_TYPE_TAG_FILE	0x656C6946
#define OB_TYPE_TAG_KEY		0x2079654B
#define OB_TYPE_TAG_PROCESS	0x636F7250

/******************************************************************/
/* Types                                                          */
/******************************************************************/

typedef struct {
  BOOL		ReplaceIfExists ;
  HANDLE	RootDirectory ;
  ULONG		FileNameLength ;
  WCHAR		FileName[1] ;
} FILE_LINK_RENAME_INFORMATION ;

typedef struct _SYSTEM_PROCESS_INFORMATION {
    ULONG NextEntryOffset;
    BYTE Reserved1[52];
    PVOID Reserved2[3];
    HANDLE UniqueProcessId;
    PVOID Reserved3;
    ULONG HandleCount;
    BYTE Reserved4[4];
    PVOID Reserved5[11];
    SIZE_T PeakPagefileUsage;
    SIZE_T PrivatePageCount;
    LARGE_INTEGER Reserved6[6];
} SYSTEM_PROCESS_INFORMATION;

typedef struct PACKED _PEB {

  BOOLEAN                 InheritedAddressSpace;
  BOOLEAN                 ReadImageFileExecOptions;
  BOOLEAN                 BeingDebugged;
  BOOLEAN                 Spare;
  HANDLE                  Mutant;
  PVOID                   ImageBaseAddress;
  PVOID                   LoaderData;
  PRTL_USER_PROCESS_PARAMETERS ProcessParameters;
  PVOID                   SubSystemData;
  PVOID                   ProcessHeap;
  PVOID                   FastPebLock;
  PVOID                   FastPebLockRoutine;
  PVOID                   FastPebUnlockRoutine;
  ULONG                   EnvironmentUpdateCount;
  PPVOID                  KernelCallbackTable;
  PVOID                   EventLogSection;
  PVOID                   EventLog;
  PVOID                   FreeList;
  ULONG                   TlsExpansionCounter;
  PVOID                   TlsBitmap;
  ULONG                   TlsBitmapBits[0x2];
  PVOID                   ReadOnlySharedMemoryBase;
  PVOID                   ReadOnlySharedMemoryHeap;
  PPVOID                  ReadOnlyStaticServerData;
  PVOID                   AnsiCodePageData;
  PVOID                   OemCodePageData;
  PVOID                   UnicodeCaseTableData;
  ULONG                   NumberOfProcessors;
  ULONG                   NtGlobalFlag;
  BYTE                    Spare2[0x4];
  LARGE_INTEGER           CriticalSectionTimeout;
  ULONG                   HeapSegmentReserve;
  ULONG                   HeapSegmentCommit;
  ULONG                   HeapDeCommitTotalFreeThreshold;
  ULONG                   HeapDeCommitFreeBlockThreshold;
  ULONG                   NumberOfHeaps;
  ULONG                   MaximumNumberOfHeaps;
  PPVOID                  *ProcessHeaps;
  PVOID                   GdiSharedHandleTable;
  PVOID                   ProcessStarterHelper;
  PVOID                   GdiDCAttributeList;
  PVOID                   LoaderLock;
  ULONG                   OSMajorVersion;
  ULONG                   OSMinorVersion;
  ULONG                   OSBuildNumber;
  ULONG                   OSPlatformId;
  ULONG                   ImageSubSystem;
  ULONG                   ImageSubSystemMajorVersion;
  ULONG                   ImageSubSystemMinorVersion;
  ULONG                   GdiHandleBuffer[0x22];
  ULONG                   PostProcessInitRoutine;
  ULONG                   TlsExpansionBitmap;
  BYTE                    TlsExpansionBitmapBits[0x80];
  ULONG                   SessionId;

} PEB, *PPEB;

typedef struct PACKED _TEB
{
  NT_TIB Tib;
  PVOID EnvironmentPointer;
  CLIENT_ID ClientId;
  HANDLE RpcHandle;
  PPVOID ThreadLocalStorage;
  PPEB Peb;
  DWORD LastErrorValue;

} TEB, *PTEB ;

struct _HANDLE_TABLE_ENTRY_INFO ;

typedef struct _HANDLE_TABLE_ENTRY_INFO *PHANDLE_TABLE_ENTRY_INFO ;

typedef DWORD EX_PUSH_LOCK ;

typedef struct PACKED _HANDLE_TABLE_ENTRY 
{
  union 
  {
    PVOID	Object;
    ULONG	ObAttributes;
    PHANDLE_TABLE_ENTRY_INFO	InfoTable;
    ULONG	Value;
  } ;
  
  union 
  {
    ULONG	GrantedAccess;
    struct 
    {
      USHORT	GrantedAccessIndex;
      USHORT	CreatorBackTraceIndex;
    } ;
    LONG	NextFreeTableEntry;
  };

} HANDLE_TABLE_ENTRY, *PHANDLE_TABLE_ENTRY;

typedef struct PACKED _HANDLE_TABLE_W2K
{
  DWORD			Flags ;
  LONG			HandleCount ;
  HANDLE_TABLE_ENTRY***	Table ;
  PEPROCESS		QuotaProcess ;
  PVOID			UniqueProcessId ;
  LONG			FirstFreeTableEntry ;
  LONG			NextIndexNeedingPool ;
  ERESOURCE		HandleTableLock ;
  LIST_ENTRY		HandleTableList ;
  KEVENT		HandleContentionEvent ;
} HANDLE_TABLE_W2K, *PHANDLE_TABLE_W2K ;


typedef struct PACKED _HANDLE_TABLE_WXP
{
  HANDLE_TABLE_ENTRY***	TableCode ;
  PEPROCESS		QuotaProcess ;
  PVOID			UniqueProcessId ;
  EX_PUSH_LOCK		HandleLock[4] ;
  LIST_ENTRY		HandleTableList ;
  EX_PUSH_LOCK		HandleContentionEvent ;
  PVOID			DebugInfo ;
  LONG			ExtraInfoPages ;
  ULONG			Flags ;
  LONG			FirstFreeHandle ;
  PHANDLE_TABLE_ENTRY	LastFreeHandleEntry ;
  LONG			HandleCount ;
  ULONG			NextHandleNeedingPool ;
} HANDLE_TABLE_WXP, *PHANDLE_TABLE_WXP ;

typedef union _HANDLE_TABLE
{
  HANDLE_TABLE_W2K w2k ;
  HANDLE_TABLE_WXP wxp ;
} HANDLE_TABLE, *PHANDLE_TABLE ;

struct _OBJECT_CREATE_INFORMATION ;

typedef struct _OBJECT_CREATE_INFORMATION OBJECT_CREATE_INFORMATION, *POBJECT_CREATE_INFORMATION ;

typedef NTSTATUS
(NTAPI *OB_QUERYNAME_METHOD)(
    IN PVOID Object,
    ULONG bZeroAfaik,
    OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
    IN ULONG Length,
    OUT PULONG ReturnLength
);


typedef struct PACKED _OBJECT_TYPE_INITIALIZER
{
  USHORT	Length ;
  UCHAR		UseDefaultObject ;
  UCHAR		Reserved ;
  ULONG		InvalidAttributes ;
  GENERIC_MAPPING	GenericMapping ;
  ULONG		ValidAccessMask ;
  UCHAR		SecurityRequired ;
  UCHAR		MaintainHandleCount ;
  UCHAR		MaintainTypeList ;
  UCHAR		Reserved2 ;
  LONG		PoolType ;
  ULONG		DefaultPagedPoolCharge ;
  ULONG		DefaultNonPagedPoolCharge ;
  PVOID		DumpProcedure ;
  PVOID		OpenProcedure ;
  PVOID		CloseProcedure ;
  PVOID		DeleteProcedure ;
  PVOID		ParseProcedure ;
  PVOID		SecurityProcedure ;
  PVOID		QueryNameProcedure ;
  PVOID		OkayToCloseProcedure ;

} OBJECT_TYPE_INITIALIZER, *POBJECT_TYPE_INITIALIZER ;

typedef struct PACKED _OBJECT_TYPE
{
  ERESOURCE		Mutex ;
  LIST_ENTRY		TypeList ;
  UNICODE_STRING	Name ;
  union {
    PVOID		DefaultObject ;
    ULONG		Code ;
  } ;
  ULONG			Index ;
  ULONG			TotalNumberOfObjects ;
  ULONG			TotalNumberOfHandles ;
  ULONG			HighWaterNumberOfObjects ;
  ULONG			HighWaterNumberOfHandles ;
  OBJECT_TYPE_INITIALIZER	TypeInfo ;
  ULONG			Key ;
} OBJECT_TYPE, *POBJECT_TYPE ;


typedef struct PACKED _OBJECT_HEADER
{
  LONG			PointerCount ;
  union
  {
    LONG		HandleCount ;
    PSINGLE_LIST_ENTRY	SEntry ;
  } ;
  POBJECT_TYPE		Type ;
  BYTE			NameInfoOffset ;
  BYTE			HandleInfoOffset ;
  BYTE			QuotaInfoOffset ;
  BYTE			Flags ;
  union
  {
    POBJECT_CREATE_INFORMATION	ObjectCreateInfo ;
    PVOID			QuotaBlockCharged ;
  } ;
  PVOID			SecurityDescriptor ;
  BYTE			Body[8] ;
} OBJECT_HEADER, *POBJECT_HEADER ;


typedef struct PACKED _FILE_OBJECT_W2K
{
  SHORT			Type ;
  SHORT			Size ;
  PDEVICE_OBJECT	DeviceObject ;
  PVPB			Vpb ;
  PVOID			FsContext ;
  PVOID			FsContext2 ;
  PSECTION_OBJECT_POINTERS	SectionObjectPointer ;
  PVOID			PrivateCacheMap ;
  LONG			FinalStatus ;
  struct _FILE_OBJECT_W2K*	RelatedFileObject ;
  BYTE			LockOperation ;
  BYTE			DeletePending ;
  BYTE			ReadAccess ;
  BYTE			WriteAccess ;
  BYTE			DeleteAccess ;
  BYTE			SharedRead ;
  BYTE			SharedWrite ;
  BYTE			SharedDelete ;
  ULONG			Flags ;
  UNICODE_STRING	FileName ;
  LARGE_INTEGER		CurrentByteOffset ;
  ULONG			Waiters ;
  ULONG			Busy ;
  PVOID			LastLock ;
  KEVENT		Lock ;
  KEVENT		Event ;
  PIO_COMPLETION_CONTEXT	CompletionContext ;
} FILE_OBJECT_W2K, *PFILE_OBJECT_W2K ;

typedef struct PACKED _KGDTENTRY
{
  USHORT	LimitLow ;
  USHORT	BaseLow ;
  ULONG		HighWord ;
} KGDTENTRY, *PKGDTENTRY ;

typedef struct PACKED _KIDTENTRY
{
  USHORT	Offset ;
  USHORT	Selector ;
  USHORT	Access ;
  USHORT	ExtendedOffset ;	
} KIDTENTRY, *PKIDTENTRY ;

typedef union _EX_RUNDOWN_REF
{
  ULONG		Count ;
  PVOID		Ptr ;
} EX_RUNDOWN_REF, *PEX_RUNDOWN_REF ;

typedef union _EX_FAST_REF
{
  PVOID		Object ;
  ULONG		Value ;
} EX_FAST_REF, *PEX_FAST_REF ;

typedef struct _KAPC_STATE
{
  LIST_ENTRY	ApcListHead[2] ;
  PVOID		Process ;
  UCHAR		KernelApcInProgress ;
  UCHAR		KernelApcPending ;
  UCHAR		UserApcPending ;
  UCHAR		Padding ;
} KAPC_STATE, *PKAPC_STATE ;

typedef struct PACKED _KQUEUE
{
  DISPATCHER_HEADER Header ;
  LIST_ENTRY	EntryListHead ;
  ULONG		CurrentCount ;
  ULONG		MaximumCount ;
  LIST_ENTRY	ThreadListHead ;
} KQUEUE, *PKQUEUE ;

typedef struct _EXCEPTION_REGISTRATION_RECORD
{
  struct _EXCEPTION_REGISTRATION_RECORD* Next ;
  VOID *		Handler ;
} EXCEPTION_REGISTRATION_RECORD ;

typedef struct _SE_AUDIT_PROCESS_CREATION_INFO
{
  OBJECT_NAME_INFORMATION* ImageFileName ;
} SE_AUDIT_PROCESS_CREATION_INFO, *PSE_AUDIT_PROCESS_CREATION_INFO ;

typedef struct PACKED MMSUPPORT 
{
  /* +0x000 */ LARGE_INTEGER	LastTrimTime ;
  /* +0x008 */ ULONG	Flags ;
  /* +0x00c */ ULONG	PageFaultCount ;
  /* +0x010 */ ULONG	PeakWorkingSetSize ;
  /* +0x014 */ ULONG	WorkingSetSize ;
  /* +0x018 */ ULONG	MinimumWorkingSetSize ;
  /* +0x01c */ ULONG	MaximumWorkingSetSize ;
  /* +0x020 */ VOID*	VmWorkingSetList ;
  /* +0x024 */ LIST_ENTRY	WorkingSetExpansionLinks ;
  /* +0x02c */ ULONG	Claim ;
  /* +0x030 */ ULONG	NextEstimationSlot ;
  /* +0x034 */ ULONG	NextAgingSlot ;
  /* +0x038 */ ULONG	EstimatedAvailable ;
  /* +0x03c */ ULONG	GrowthSinceLastEstimate ;
} MMSUPPORT, *PMMSUPPORT ;

typedef struct PACKED _KTRAP_FRAME
{
  /* +0x000 */ ULONG	DbgEbp ;
  /* +0x004 */ ULONG	DbgEip ;
  /* +0x008 */ ULONG	DbgArgMark ;
  /* +0x00c */ ULONG	DbgArgPointer ;
  /* +0x010 */ ULONG	TempSegCs ;
  /* +0x014 */ ULONG	TempEsp ;
  /* +0x018 */ ULONG	Dr0 ;
  /* +0x01c */ ULONG	Dr1 ;
  /* +0x020 */ ULONG	Dr2 ;
  /* +0x024 */ ULONG	Dr3 ;
  /* +0x028 */ ULONG	Dr6 ;
  /* +0x02c */ ULONG	Dr7 ;
  /* +0x030 */ ULONG	SegGs ;
  /* +0x034 */ ULONG	SegEs ;
  /* +0x038 */ ULONG	SegDs ;
  /* +0x03c */ ULONG	Edx ;
  /* +0x040 */ ULONG	Ecx ;
  /* +0x044 */ ULONG	Eax ;
  /* +0x048 */ ULONG	PreviousPreviousMode ;
  /* +0x04c */ EXCEPTION_REGISTRATION_RECORD*	ExceptionList ;
  /* +0x050 */ ULONG	SegFs ;
  /* +0x054 */ ULONG	Edi ;
  /* +0x058 */ ULONG	Esi ;
  /* +0x05c */ ULONG	Ebx ;
  /* +0x060 */ ULONG	Ebp ;
  /* +0x064 */ ULONG	ErrCode ;
  /* +0x068 */ ULONG	Eip ;
  /* +0x06c */ ULONG	SegCs ;
  /* +0x070 */ ULONG	EFlags ;
  /* +0x074 */ ULONG	HardwareEsp ;
  /* +0x078 */ ULONG	HardwareSegSs ;
  /* +0x07c */ ULONG	V86Es ;
  /* +0x080 */ ULONG	V86Ds ;
  /* +0x084 */ ULONG	V86Fs ;
  /* +0x088 */ ULONG	V86Gs ;
} KTRAP_FRAME, *PKTRAP_FRAME ;

typedef struct PACKED _KPROCESS_WXP
{
  /* +0x000 */ DISPATCHER_HEADER	Header ;
  /* +0x010 */ LIST_ENTRY	ProfileListHead ;
  /* +0x018 */ ULONG	DirectoryTableBase[2] ;
  /* +0x020 */ KGDTENTRY	LdtDescriptor ;
  /* +0x028 */ KIDTENTRY	Int21Descriptor ;
  /* +0x030 */ USHORT	IopmOffset ;
  /* +0x032 */ UCHAR	Iopl ;
  /* +0x033 */ UCHAR	Unused ;
  /* +0x034 */ ULONG	ActiveProcessors ;
  /* +0x038 */ ULONG	KernelTime ;
  /* +0x03c */ ULONG	UserTime ;
  /* +0x040 */ LIST_ENTRY	ReadyListHead ;
  /* +0x048 */ SINGLE_LIST_ENTRY	SwapListEntry ;
  /* +0x04c */ PVOID	VdmTrapcHandler ;
  /* +0x050 */ LIST_ENTRY	ThreadListHead ;
  /* +0x058 */ ULONG	ProcessLock ;
  /* +0x05c */ ULONG	Affinity ;
  /* +0x060 */ USHORT	StackCount ;
  /* +0x062 */ CHAR	BasePriority ;
  /* +0x063 */ CHAR	ThreadQuantum ;
  /* +0x064 */ UCHAR	AutoAlignment ;
  /* +0x065 */ UCHAR	State ;
  /* +0x066 */ UCHAR	ThreadSeed ;
  /* +0x067 */ UCHAR	DisableBoost ;
  /* +0x068 */ UCHAR	PowerState ;
  /* +0x069 */ UCHAR	DisableQuantum ;
  /* +0x06a */ UCHAR	IdealNode ;
  union {
    /* +0x06b */ UCHAR	Flags ;
    /* +0x06b */ UCHAR	ExecuteOptions ;
  } ;
} KPROCESS_WXP, *PKPROCESS_WXP ;



typedef struct /*PACKED*/ _KTHREAD_WXP 
{
  /* +0x000 */ DISPATCHER_HEADER	Header ;
  /* +0x010 */ LIST_ENTRY	MutantListHead ;
  /* +0x018 */ PVOID	InitialStack ;
  /* +0x01c */ PVOID	StackLimit ;
  /* +0x020 */ PVOID	Teb ;
  /* +0x024 */ PVOID	TlsArray ;
  /* +0x028 */ PVOID	KernelStack ;
  /* +0x02c */ UCHAR	DebugActive ;
  /* +0x02d */ UCHAR	State ;
  /* +0x02e */ UCHAR	Alerted[2] ;
  /* +0x030 */ UCHAR	Iopl ;
  /* +0x031 */ UCHAR	NpxState ;
  /* +0x032 */ CHAR	Saturation ;
  /* +0x033 */ CHAR	Priority ;
  /* +0x034 */ KAPC_STATE	ApcState ;
  /* +0x04c */ ULONG	ContextSwitches ;
  /* +0x050 */ UCHAR	IdleSwapBlock ;
  /* +0x051 */ UCHAR	Spare0[3] ;
  /* +0x054 */ LONG	WaitStatus ;
  /* +0x058 */ UCHAR	WaitIrql ;
  /* +0x059 */ CHAR	WaitMode ;
  /* +0x05a */ UCHAR	WaitNext ;
  /* +0x05b */ UCHAR	WaitReason ;
  /* +0x05c */ KWAIT_BLOCK*	WaitBlockList ;
  /* +0x060 */ LIST_ENTRY	WaitListEntry ;
  /* +0x060 */ SINGLE_LIST_ENTRY	SwapListEntry ;
  /* +0x068 */ ULONG	WaitTime ;
  /* +0x06c */ CHAR	BasePriority ;
  /* +0x06d */ UCHAR	DecrementCount ;
  /* +0x06e */ CHAR	PriorityDecrement ;
  /* +0x06f */ CHAR	Quantum ;
  /* +0x070 */ KWAIT_BLOCK	WaitBlock[4] ;
  /* +0x0d0 */ PVOID	LegoData ;
  /* +0x0d4 */ ULONG	KernelApcDisable ;
  /* +0x0d8 */ ULONG	UserAffinity ;
  /* +0x0dc */ UCHAR	SystemAffinityActive ;
  /* +0x0dd */ UCHAR	PowerState ;
  /* +0x0de */ UCHAR	NpxIrql ;
  /* +0x0df */ UCHAR	InitialNode ;
  /* +0x0e0 */ PVOID	ServiceTable ;
  /* +0x0e4 */ KQUEUE*	Queue ;
  /* +0x0e8 */ ULONG	ApcQueueLock ;
  /* +0x0f0 */ KTIMER	Timer ;
  /* +0x118 */ LIST_ENTRY	QueueListEntry ;
  /* +0x120 */ ULONG	SoftAffinity ;
  /* +0x124 */ ULONG	Affinity ;
  /* +0x128 */ UCHAR	Preempted ;
  /* +0x129 */ UCHAR	ProcessReadyQueue ;
  /* +0x12a */ UCHAR	KernelStackResident ;
  /* +0x12b */ UCHAR	NextProcessor ;
  /* +0x12c */ PVOID	CallbackStack ;
  /* +0x130 */ PVOID	Win32Thread ;
  /* +0x134 */ KTRAP_FRAME*	TrapFrame ;
  /* +0x138 */ KAPC_STATE*	ApcStatePointer[2] ;
  /* +0x140 */ CHAR	PreviousMode ;
  /* +0x141 */ UCHAR	EnableStackSwap ;
  /* +0x142 */ UCHAR	LargeStack ;
  /* +0x143 */ UCHAR	ResourceIndex ;
  /* +0x144 */ ULONG	KernelTime ;
  /* +0x148 */ ULONG	UserTime ;
  /* +0x14c */ KAPC_STATE	SavedApcState ;
  /* +0x164 */ UCHAR	Alertable ;
  /* +0x165 */ UCHAR	ApcStateIndex ;
  /* +0x166 */ UCHAR	ApcQueueable ;
  /* +0x167 */ UCHAR	AutoAlignment ;
  /* +0x168 */ PVOID	StackBase ;
  /* +0x16c */ KAPC	SuspendApc ;
  /* +0x19c */ KSEMAPHORE	SuspendSemaphore ;
  /* +0x1b0 */ LIST_ENTRY	ThreadListEntry ;
  /* +0x1b8 */ CHAR	FreezeCount ;
  /* +0x1b9 */ CHAR	SuspendCount ;
  /* +0x1ba */ UCHAR	IdealProcessor ;
  /* +0x1bb */ UCHAR	DisableBoost ;
} KTHREAD_WXP, *PKTHREAD_WXP ;

typedef struct PACKED _EJOB
{
  /* +0x000 */ KEVENT	Event ;
  /* +0x010 */ LIST_ENTRY	JobLinks ;
  /* +0x018 */ LIST_ENTRY	ProcessListHead ;
  /* +0x020 */ ERESOURCE	JobLock ;
  /* +0x058 */ LARGE_INTEGER	TotalUserTime ;
  /* +0x060 */ LARGE_INTEGER	TotalKernelTime ;
  /* +0x068 */ LARGE_INTEGER	ThisPeriodTotalUserTime ;
  /* +0x070 */ LARGE_INTEGER	ThisPeriodTotalKernelTime ;
  /* +0x078 */ ULONG	TotalPageFaultCount ;
  /* +0x07c */ ULONG	TotalProcesses ;
  /* +0x080 */ ULONG	ActiveProcesses ;
  /* +0x084 */ ULONG	TotalTerminatedProcesses ;
  /* +0x088 */ LARGE_INTEGER	PerProcessUserTimeLimit ;
  /* +0x090 */ LARGE_INTEGER	PerJobUserTimeLimit ;
  /* +0x098 */ ULONG	LimitFlags ;
  /* +0x09c */ ULONG	MinimumWorkingSetSize ;
  /* +0x0a0 */ ULONG	MaximumWorkingSetSize ;
  /* +0x0a4 */ ULONG	ActiveProcessLimit ;
  /* +0x0a8 */ ULONG	Affinity ;
  /* +0x0ac */ UCHAR	PriorityClass ;
  /* +0x0b0 */ ULONG	UIRestrictionsClass ;
  /* +0x0b4 */ ULONG	SecurityLimitFlags ;
  /* +0x0b8 */ PVOID	Token ;
  /* +0x0bc */ PVOID	Filter ;
  /* +0x0c0 */ ULONG	EndOfJobTimeAction ;
  /* +0x0c4 */ PVOID	CompletionPort ;
  /* +0x0c8 */ PVOID	CompletionKey ;
  /* +0x0cc */ ULONG	SessionId ;
  /* +0x0d0 */ ULONG	SchedulingClass ;
  /* +0x0d8 */ ULONGLONG	ReadOperationCount ;
  /* +0x0e0 */ ULONGLONG	WriteOperationCount ;
  /* +0x0e8 */ ULONGLONG	OtherOperationCount ;
  /* +0x0f0 */ ULONGLONG	ReadTransferCount ;
  /* +0x0f8 */ ULONGLONG	WriteTransferCount ;
  /* +0x100 */ ULONGLONG	OtherTransferCount ;
  /* +0x108 */ IO_COUNTERS	IoInfo ;
  /* +0x138 */ ULONG	ProcessMemoryLimit ;
  /* +0x13c */ ULONG	JobMemoryLimit ;
  /* +0x140 */ ULONG	PeakProcessMemoryUsed ;
  /* +0x144 */ ULONG	PeakJobMemoryUsed ;
  /* +0x148 */ ULONG	CurrentJobMemoryUsed ;
  /* +0x14c */ FAST_MUTEX	MemoryLimitsLock ;
  /* +0x16c */ LIST_ENTRY	JobSetLinks ;
  /* +0x174 */ ULONG	MemberLevel ;
  /* +0x178 */ ULONG	JobFlags ;
} EJOB, *PEJOB ;

typedef struct _EPROCESS_WXP
{
  /* +0x000 */ KPROCESS_WXP	Pcb ;
  /* +0x06c */ EX_PUSH_LOCK	ProcessLock ;
  /* +0x070 */ LARGE_INTEGER	CreateTime ;
  /* +0x078 */ LARGE_INTEGER	ExitTime ;
  /* +0x080 */ EX_RUNDOWN_REF	RundownProtect ;
  /* +0x084 */ PVOID	UniqueProcessId ;
  /* +0x088 */ LIST_ENTRY	ActiveProcessLinks ;
  /* +0x090 */ ULONG	QuotaUsage[3] ;
  /* +0x09c */ ULONG	QuotaPeak[3] ;
  /* +0x0a8 */ ULONG	CommitCHARge ;
  /* +0x0ac */ ULONG	PeakVirtualSize ;
  /* +0x0b0 */ ULONG	VirtualSize ;
  /* +0x0b4 */ LIST_ENTRY	SessionProcessLinks ;
  /* +0x0bc */ PVOID	DebugPort ;
  /* +0x0c0 */ PVOID	ExceptionPort ;
  /* +0x0c4 */ HANDLE_TABLE*	ObjectTable ;
  /* +0x0c8 */ EX_FAST_REF	Token ;
  /* +0x0cc */ FAST_MUTEX	WorkingSetLock ;
  /* +0x0ec */ ULONG	WorkingSetPage ;
  /* +0x0f0 */ FAST_MUTEX	AddressCreationLock ;
  /* +0x110 */ ULONG	HyperSpaceLock ;
  /* +0x114 */ struct _ETHREAD_WXP*	ForkInProgress ;
  /* +0x118 */ ULONG	HardwareTrigger ;
  /* +0x11c */ PVOID	VadRoot ;
  /* +0x120 */ PVOID	VadHint ;
  /* +0x124 */ PVOID	CloneRoot ;
  /* +0x128 */ ULONG	NumberOfPrivatePages ;
  /* +0x12c */ ULONG	NumberOfLockedPages ;
  /* +0x130 */ PVOID	Win32Process ;
  /* +0x134 */ EJOB*	Job ;
  /* +0x138 */ PVOID	SectionObject ;
  /* +0x13c */ PVOID	SectionBaseAddress ;
  /* +0x140 */ PVOID	QuotaBlock ;
  /* +0x144 */ PVOID	WorkingSetWatch ;
  /* +0x148 */ PVOID	Win32WindowStation ;
  /* +0x14c */ PVOID	InheritedFromUniqueProcessId ;
  /* +0x150 */ PVOID	LdtInformation ;
  /* +0x154 */ PVOID	VadFreeHint ;
  /* +0x158 */ PVOID	VdmObjects ;
  /* +0x15c */ PVOID	DeviceMap ;
  /* +0x160 */ LIST_ENTRY	PhysicalVadList ;
  /* +0x168 */ ULONGLONG	PageDirectoryPte ;
  /* +0x170 */ PVOID	Session ;
  /* +0x174 */ UCHAR	ImageFileName[16] ;
  /* +0x184 */ LIST_ENTRY	JobLinks ;
  /* +0x18c */ PVOID	LockedPagesList ;
  /* +0x190 */ LIST_ENTRY	ThreadListHead ;
  /* +0x198 */ PVOID	SecurityPort ;
  /* +0x19c */ PVOID	PaeTop ;
  /* +0x1a0 */ ULONG	ActiveThreads ;
  /* +0x1a4 */ ULONG	GrantedAccess ;
  /* +0x1a8 */ ULONG	DefaultHardErrorProcessing ;
  /* +0x1ac */ LONG	LastThreadExitStatus ;
  /* +0x1b0 */ PEB*	Peb ;
  /* +0x1b4 */ EX_FAST_REF	PrefetchTrace ;
  /* +0x1b8 */ LARGE_INTEGER	ReadOperationCount ;
  /* +0x1c0 */ LARGE_INTEGER	WriteOperationCount ;
  /* +0x1c8 */ LARGE_INTEGER	OtherOperationCount ;
  /* +0x1d0 */ LARGE_INTEGER	ReadTransferCount ;
  /* +0x1d8 */ LARGE_INTEGER	WriteTransferCount ;
  /* +0x1e0 */ LARGE_INTEGER	OtherTransferCount ;
  /* +0x1e8 */ ULONG	CommitCHARgeLimit ;
  /* +0x1ec */ ULONG	CommitCHARgePeak ;
  /* +0x1f0 */ PVOID	AweInfo ;
  /* +0x1f4 */ SE_AUDIT_PROCESS_CREATION_INFO	SeAuditProcessCreationInfo ;
  /* +0x1f8 */ MMSUPPORT	Vm ;
  /* +0x238 */ ULONG	LastFaultCount ;
  /* +0x23c */ ULONG	ModifiedPageCount ;
  /* +0x240 */ ULONG	NumberOfVads ;
  /* +0x244 */ ULONG	JobStatus ;
  /* +0x248 */ ULONG	Flags ;
  /*    +0x248 CreateReported   : Pos 0, 1 Bit */
  /*    +0x248 NoDebugInherit   : Pos 1, 1 Bit */
  /*    +0x248 ProcessExiting   : Pos 2, 1 Bit */
  /*    +0x248 ProcessDelete    : Pos 3, 1 Bit */
  /*    +0x248 Wow64SplitPages  : Pos 4, 1 Bit */
  /*    +0x248 VmDeleted        : Pos 5, 1 Bit */
  /*    +0x248 OutswapEnabled   : Pos 6, 1 Bit */
  /*    +0x248 Outswapped       : Pos 7, 1 Bit */
  /*    +0x248 ForkFailed       : Pos 8, 1 Bit */
  /*    +0x248 HasPhysicalVad   : Pos 9, 1 Bit */
  /*    +0x248 AddressSpaceInitialized : Pos 10, 2 Bits */
  /*    +0x248 SetTimerResolution : Pos 12, 1 Bit */
  /*    +0x248 BreakOnTermination : Pos 13, 1 Bit */
  /*    +0x248 SessionCreationUnderway : Pos 14, 1 Bit */
  /*    +0x248 WriteWatch       : Pos 15, 1 Bit */
  /*    +0x248 ProcessInSession : Pos 16, 1 Bit */
  /*    +0x248 OverrideAddressSpace : Pos 17, 1 Bit */
  /*    +0x248 HasAddressSpace  : Pos 18, 1 Bit */
  /*    +0x248 LaunchPrefetched : Pos 19, 1 Bit */
  /*    +0x248 InjectInpageErrors : Pos 20, 1 Bit */
  /*    +0x248 VmTopDown        : Pos 21, 1 Bit */
  /*    +0x248 Unused3          : Pos 22, 1 Bit */
  /*    +0x248 Unused4          : Pos 23, 1 Bit */
  /*    +0x248 VdmAllowed       : Pos 24, 1 Bit */
  /*    +0x248 Unused           : Pos 25, 5 Bits */
  /*    +0x248 Unused1          : Pos 30, 1 Bit */
  /*    +0x248 Unused2          : Pos 31, 1 Bit */
  /* +0x24c */ LONG	ExitStatus ;
  /* +0x250 */ USHORT	NextPageColor ;
  /* +0x252 */ UCHAR	SubSystemMinorVersion ;
  /* +0x253 */ UCHAR	SubSystemMajorVersion ;
  /* +0x254 */ UCHAR	PriorityClass ;
  /* +0x255 */ UCHAR	WorkingSetAcquiredUnsafe ;
  /* +0x258 */ ULONG	Cookie ;
} EPROCESS_WXP, *PEPROCESS_WXP ;

typedef struct _ETHREAD_WXP
{
  /* +0x000 */ KTHREAD_WXP	Tcb ;
  /* +0x1c0 */ LARGE_INTEGER	CreateTime ;
  /*    +0x1c0 NestedFaultCount : Pos 0, 2 Bits */
  /*    +0x1c0 ApcNeeded        : Pos 2, 1 Bit */
  union {
    /* +0x1c8 */ LARGE_INTEGER	ExitTime ;
    /* +0x1c8 */ LIST_ENTRY	LpcReplyChain ;
    /* +0x1c8 */ LIST_ENTRY	KeyedWaitChain ;
  } ;
  union {
    /* +0x1d0 */ LONG	ExitStatus ;
    /* +0x1d0 */ PVOID	OfsChain ;
  } ;
  /* +0x1d4 */ LIST_ENTRY	PostBlockList ;
  union {
    /* +0x1dc */ PVOID	TerminationPort ;
    /* +0x1dc */ struct _ETHREAD_WXP*	ReaperLink ;
    /* +0x1dc */ PVOID	KeyedWaitValue ;
  } ;
  /* +0x1e0 */ ULONG	ActiveTimerListLock ;
  /* +0x1e4 */ LIST_ENTRY	ActiveTimerListHead ;
  /* +0x1ec */ CLIENT_ID	Cid ;
  union {
    /* +0x1f4 */ KSEMAPHORE	LpcReplySemaphore ;
    /* +0x1f4 */ KSEMAPHORE	KeyedWaitSemaphore ;
  } ;
  union {
    /* +0x208 */ PVOID	LpcReplyMessage ;
    /* +0x208 */ PVOID	LpcWaitingOnPort ;
  } ;
  /* +0x20c */ PVOID	ImpersonationInfo ;
  /* +0x210 */ LIST_ENTRY	IrpList ;
  /* +0x218 */ ULONG	TopLevelIrp ;
  /* +0x21c */ DEVICE_OBJECT*	DeviceToVerify ;
  /* +0x220 */ struct _EPROCESS_WXP*	ThreadsProcess ;
  /* +0x224 */ PVOID	StartAddress ;
  union {
    /* +0x228 */ PVOID	Win32StartAddress ;
    /* +0x228 */ ULONG	LpcReceivedMessageId ;
  } ;
  /* +0x22c */ LIST_ENTRY	ThreadListEntry ;
  /* +0x234 */ EX_RUNDOWN_REF	RundownProtect ;
  /* +0x238 */ EX_PUSH_LOCK	ThreadLock ;
  /* +0x23c */ ULONG	LpcReplyMessageId ;
  /* +0x240 */ ULONG	ReadClusterSize ;
  /* +0x244 */ ULONG	GrantedAccess ;
  /* +0x248 */ ULONG	CrossThreadFlags ;
  /*    +0x248 Terminated       : Pos 0, 1 Bit */
  /*    +0x248 DeadThread       : Pos 1, 1 Bit */
  /*    +0x248 HideFromDebugger : Pos 2, 1 Bit */
  /*    +0x248 ActiveImpersonationInfo : Pos 3, 1 Bit */
  /*    +0x248 SystemThread     : Pos 4, 1 Bit */
  /*    +0x248 HardErrorsAreDisabled : Pos 5, 1 Bit */
  /*    +0x248 BreakOnTermination : Pos 6, 1 Bit */
  /*    +0x248 SkipCreationMsg  : Pos 7, 1 Bit */
  /*    +0x248 SkipTerminationMsg : Pos 8, 1 Bit */
  /* +0x24c */ ULONG	SameThreadPassiveFlags ;
  /*    +0x24c ActiveExWorker   : Pos 0, 1 Bit */
  /*    +0x24c ExWorkerCanWaitUser : Pos 1, 1 Bit */
  /*    +0x24c MemoryMaker      : Pos 2, 1 Bit */
  /* +0x250 */ ULONG	SameThreadApcFlags ;
  /*    +0x250 LpcReceivedMsgIdValid : Pos 0, 1 Bit */
  /*    +0x250 LpcExitThreadCalled : Pos 1, 1 Bit */
  /*    +0x250 AddressSpaceOwner : Pos 2, 1 Bit */
  /* +0x254 */ UCHAR	ForwardClusterOnly ;
  /* +0x255 */ UCHAR	DisablePageFaultClustering ;
} ETHREAD_WXP, *PETHREAD_WXP ;


#include "NtUndoc_Vista.h"

/******************************************************************/
/* Functions                                                      */
/******************************************************************/

typedef struct _NTUNDOC_NAMESPACE
{
  NTSTATUS DDKFASTAPI (*ExfAcquirePushLockExclusive)
    (EX_PUSH_LOCK*) ;

  NTSTATUS DDKFASTAPI (*ExfReleasePushLock)
    (EX_PUSH_LOCK*) ;

  /**************** NtCreateProcess ****************/
  NTSTATUS DDKAPI (*NtCreateProcess) 
    (PHANDLE, ACCESS_MASK,
     POBJECT_ATTRIBUTES,
     HANDLE, BOOLEAN, HANDLE, 
     HANDLE, HANDLE);
  
  /**************** NtCreateProcessEx ****************/
  NTSTATUS DDKAPI (*NtCreateProcessEx) 
    (PHANDLE, ACCESS_MASK,
     POBJECT_ATTRIBUTES,
     HANDLE, BOOLEAN, HANDLE, 
     HANDLE, HANDLE, HANDLE);
  
  /**************** NtCreateSection ****************/
  NTSTATUS DDKAPI (*NtCreateSection) 
    (OUT PHANDLE  SectionHandle,
     IN ACCESS_MASK  DesiredAccess,
     IN POBJECT_ATTRIBUTES  ObjectAttributes OPTIONAL,
     IN PLARGE_INTEGER  MaximumSize OPTIONAL,
     IN ULONG  SectionPageProtection,
     IN ULONG  AllocationAttributes,
     IN HANDLE  FileHandle OPTIONAL) ;

  /**************** NtCreateUserProcess ****************/
  NTSTATUS DDKAPI (*NtCreateUserProcess)
    (PHANDLE, PVOID, PVOID, PVOID, 
     PVOID, PVOID, PVOID, PVOID, 
     PVOID, PVOID, PVOID, PVOID) ; 
  
  /**************** NtTerminateProcess ****************/
  NTSTATUS DDKAPI (*NtTerminateProcess)
    (IN HANDLE ProcessHandle OPTIONAL, 
     IN NTSTATUS ExitStatus) ; 
  
  /**************** NtQueryInformationFile ****************/
  NTSTATUS DDKAPI (*NtQueryInformationFile)
    (HANDLE, PIO_STATUS_BLOCK,
     PVOID, ULONG, ULONG) ;
  
  /**************** NtQueryKey ****************/
  NTSTATUS DDKAPI (*NtQueryKey)
    (HANDLE,KEY_INFORMATION_CLASS,
     PVOID,ULONG,PULONG) ;

  /**************** ZwQueryValueKey ****************/
  NTSTATUS DDKAPI (*NtQueryValueKey)
    (HANDLE, PUNICODE_STRING,
     KEY_VALUE_INFORMATION_CLASS,
     PVOID,ULONG,PULONG) ;

  /**************** NtSetInformationFile ****************/
  NTSTATUS DDKAPI (*NtSetInformationFile) 
    (HANDLE, PIO_STATUS_BLOCK,
     PVOID, ULONG, ULONG) ;
  
  /**************** NtSetValueKey ****************/
  NTSTATUS DDKAPI (*NtSetValueKey) 
    (HANDLE, PUNICODE_STRING, ULONG,
     ULONG, PVOID, ULONG) ;
  
  /**************** ObpFreeObject ****************/
  NTSTATUS DDKFASTAPI (*ObpFreeObject)
    (PVOID  Object) ;

  /**************** PspTerminateProcess ****************/
  NTSTATUS DDKAPI (*PspTerminateProcess)
    (IN PEPROCESS Eprocess, 
     IN NTSTATUS ExitStatus) ;

  /**************** swprintf ****************/
  INT DDKFASTAPI (*swprintf)(LPWSTR,LPCWSTR,...) ;  
  
  /**************** ZwOpenProcess ****************/
  NTSTATUS DDKAPI (*ZwOpenProcess) 
    (OUT PHANDLE             ProcessHandle,
     IN ACCESS_MASK          DesiredAccess,
     IN POBJECT_ATTRIBUTES   ObjectAttributes,
     IN PCLIENT_ID           ClientId OPTIONAL) ;
  
  NTSTATUS DDKAPI (*ZwProtectVirtualMemory)
    (IN HANDLE  ProcessHandle,
     IN OUT PVOID  *BaseAddress,
     IN OUT PULONG  ProtectSize,
     IN ULONG  NewProtect,
     OUT PULONG  OldProtect);
  
  /**************** ZwReadVirtualMemory ****************/
  NTSTATUS DDKAPI (*ZwReadVirtualMemory)
    (HANDLE, PVOID,
     PVOID, ULONG, PULONG) ;

} NTUNDOC_NAMESPACE ;


#ifndef _NTUNDOC_C

extern NTUNDOC_NAMESPACE ntundoc ;

#endif


/*
 * No more needed functions
 * Keeping them just in case
 *

typedef struct {
  ULONG  NameLength;
  WCHAR  Name[1] ;  
} KEY_NAME_INFORMATION ;


NTUNDOC NTSTATUS DDKAPI (*NtDeleteFile)(IN POBJECT_ATTRIBUTES) ;

NTUNDOC DDKAPI NTSTATUS (*NtQueryInformationProcess) (HANDLE, ULONG,
						      PVOID, ULONG, PULONG) ; 

NTUNDOC
NTSTATUS
DDKAPI 
(*NtUndoc_ObQueryNameString)
  (IN PVOID Object,
   OUT POBJECT_NAME_INFORMATION ObjectNameInfo,
   IN ULONG Length,
   OUT PULONG ReturnLength);   

NTUNDOC
NTSTATUS 
DDKFASTAPI
(*NtUndoc_ObfDereferenceObject)
  (PVOID  Object) ; 

NTUNDOC
NTSTATUS 
DDKFASTAPI
(*NtUndoc_ObFastDereferenceObject)
  (PVOID  Object) ; 


*/

NTSTATUS NtUndoc_Init() ;


#endif
